A retention policy answers two questions: how far back can you restore, and where do the copies live? The 3-2-1 rule covers the "where". A grandfather-father-son schedule covers the "how far back" without keeping every backup forever.
The 3-2-1 rule
- 3 copies of your data: the live data plus two backups.
- 2 different storage types, so one failure mode cannot take out both backups. For example, a local disk and cloud storage.
- 1 copy off-site, so a fire, theft or flood at the office does not take everything.
A common extension is 3-2-1-1-0: add one copy that is offline or immutable (ransomware cannot alter it), and aim for zero errors in restore tests.
Why ransomware changes the plan
Modern ransomware looks for backups and deletes or encrypts them before it strikes. Anything the infected machine can write to with its normal credentials is at risk: mapped drives, synced folders, NAS shares.
- Keep the off-site copy under separate credentials that are not saved in a place the office PCs can reach.
- Prefer destinations that keep old versions or deleted files for a period, such as cloud storage with version history or trash.
- Copy, don't mirror. A mirror faithfully copies deletions and encryption to the backup.
Grandfather-father-son retention
Keep many recent backups and fewer old ones. A typical small-business schedule:
| Tier | Taken | Keep | Restore points |
|---|---|---|---|
| Son (daily) | Every day | 14 days | Any day in the last two weeks |
| Father (weekly) | Sunday | 8 weeks | Weekly for two months |
| Grandfather (monthly) | First Sunday of the month | 12 months | Monthly for a year |
That is 34 restore points covering a year, instead of 365 files. Many problems are discovered weeks later, such as a deleted customer, a bad import or slowly spreading corruption. The weekly and monthly copies are what save you then.
A sample policy for a SQL Server database
| What | Where | Keep |
|---|---|---|
| Daily full (or weekly full + daily differential) | Local disk on another drive | 14 days |
| Same backups | Off-site: Google Drive, FTP/FTPS or NAS at another location | 8 weekly + 12 monthly |
| Log backups, if in FULL recovery | Local, copied off-site hourly | Since the last full backup + 7 days |
| Monthly test restore | Temporary database | Delete after checking |
Put your own sizes into the backup storage calculator to see how much space each location needs.
Legal and compliance retention
Some records must be kept for a set period, and some personal data must not be kept longer than needed. Backup retention is not the same as record retention: backups are for recovery, archives are for compliance. Check what applies to your business, for example accounting record rules and data protection law, and keep a written policy that says which is which.
Write it down
A policy that exists only in a script is not a policy. Record the schedule, retention for each location, who checks the results, how often restores are tested, and where the credentials are kept. Review it when your data or systems change.
With Velocity
Velocity sends one backup job to multiple destinations at once, for example a local folder and Google Drive or an FTP/FTPS server, which covers the "2 types, 1 off-site" part of 3-2-1 in a single scheduled job.